What’s Vulnerable › Vulnerabilities

CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-07-30
• EPSS: 26.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-25 · updated 2026-06-17
• Weakness: CWE-287

Description

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Affected products

• VMware Cloud Foundation: from 4.0 before 5.2 — fixed in 5.2
• VMware ESXi: 8.0-a, 8.0-b, 8.0-c, 8.0-update_1, 8.0-update_1a, 8.0-update_1c (+4); 8.0; 7.0 (and their updates)
• VMware Cloud Foundation: from 5.0 before 5.2 — fixed in 5.2
• VMware ESXi: 7.0
• VMware Cloud Foundation: 5.x, 4.x
• VMware ESXi: from 8.0 before ESXi80U3-24022510; 7.0 — fixed in ESXi80U3-24022510

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 5.2; VMware Cloud Foundation 5.2; VMware ESXi ESXi80U3-24022510. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37085

Get alerted when CVE-2024-37085 or the next vulnerability affects your stack